CVE-2026-109356

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase eve...

CVE-2026-109356 LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase eve...

EUVD-2026-97658

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase eve...

CVE-2026-109356 LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase eve...

CVE-2026-109356

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase eve...

CVE-2026-109356 LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase eve...

CVE-2026-109356

LibreNMS versions before 26.9.0 are susceptible to a missing authorization vulnerability in the PortsController::purge function. This flaw allows users with global-read (read-only) accounts to bypass necessary delete privileges by sending DELETE requests to the /ports/purge endpoint. By utilizing...

CVE-2026-109356: Missing Authorization

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase eve...

PT-2026-110773

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.0 Description An authorization flaw exists in the PortsController::purge function. Users with global-read permissions can bypass authorization to physically delete ports without having the required delete...